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DEPARTMENT OF HEALTH & HUMAN SERVICES 

Secretary 


Office of the 


Assistant Secretary for Public Affairs 
Washington, D.C. 20201 


Refer to; Request Number 2019-00462-FOIA-OS 

January 16, 2019 

Robert Teel 

Journalist 

MuckRock.com 

DEPT MR 54973 

411A Highland Avenue 

Somerville, MA 02144-2516 

Dear Mr. Robert Teel: 

This acknowledges receipt of your January 16, 2019, Freedom of Information Act (FOIA) request, 
submitted to the Department of Health and Human Services (HHS), FOI/Privacy Acts Division 
concerning “the following records in connection any data breach of Iowa Health System d/b/a 
UnityPoint Health and its affiliates, including: 

(1) the Email Hacking/IT Incident data breach of Iowa Health System d/b/a UnityPoint Health, 
state of Iowa, covered entity type Business Associate, affecting 16,429 individuals, and reported on 
04/16/2018; 

(2) the Email Hacking/IT Incident data breach of UW Health, state of Wisconsin, covered entity 
type Healthcare Provider, affecting 2,036 individuals, and reported on 5/25/2017; 

(3) the Electronic Medical Record Unauthorized Access/Disclosure of UnityPoint Health Affiliated 
Covered Entity, state of Iowa, covered entity type Healthcare Provider, affecting 1,620 individuals, 
and reported on 05/11/2016; and 

(4) the Electronic Medical Record Unauthorized Access/Disclosure of UnityPoint Health Affiliated 
Covered Entity, state of Iowa, covered entity type Healthcare Provider, affecting 1,620 individuals, 
and reported on 05/11/2016.” We received your request on January 16, 2019. 

We have initiated a search to locate records falling within the scope of your request. If our searching 
units advise us that you have requested a voluminous amount of records that require extensive search and 
examination, my staff will contact you shortly to discuss your willingness to modify your request. 

The FOIA requires that we respond to your request within 20 working days of its receipt in this office. 
Please note the following unusual and exceptional circumstances that will impact our response time: (1) 
we will need to search for and collect records from components and/or field offices external to this office; 
and (2) because we receive a very heavy volume of FOIA requests, we will process your request in line 
with our established policy of "first in, first out" case processing. If either of these circumstances 
prevents our office from responding within the 20 working day timeframe, we will utilize a 10 working 
day extension to process your request, as permitted pursuant to the FOIA. This policy is consistent with 
court decisions regarding FOIA’s time limits. 

The law authorizes us to collect fees for responding to FOIA requests and assume that you are willing to 
pay any applicable fees for processing this request unless you have stated otherwise. If at any time the 
fee for processing your request is estimated to exceed $250.00, we will send you an invoice for the 
estimated fee and suspend further processing until payment of the invoiced amount is received. If the 
estimated processing fee does not exceed $250.00, we will send you an invoice for the actual fee with our 
response. 


Please note the following: 



If you believe that we should expedite the processing of your request because the requested records are 
needed in light of a compelling need; i.e., an imminent threat to the life and safety of an individual; an 
urgency to inform the pnblic concerning government activity (provided you are a member of the media); a 
deadline in litigation; a deadline for commenting on proposed regulations; or other urgent matters, you 
must ask for expedited processing in writing and provide to this office as mnch relevant information as 
possible. In line with 5 U.S.C. § 552(a)(6)(E)(vi), you must demonstrate the compelling need in a 
statement certified to be trne and correct to the best of yonr knowledge and belief. Attach any snpporting 
docnmentation to your statement, inclnding a court scheduling order if yonr reqnest is based upon a 
litigation deadline. (Fax supporting documentation to the FOIA/PA Division at (202) 690-8320). 



If your request seeks a waiver or reduction of the fees that we would customarily charge for furnishing 
agency records and your request does not contain sufficient information to enable us to determine whether 
a waiver or reduction of fees is warranted, you should provide such information to this office within 10 
working days of receipt of this fetter. In line with 45 C.F.R. § 5.45, such information must include a 
detailed explanation of how disclosure to you: (1) is in the public interest because it is likely to contribute 
significantly to public understanding of tbe operations or activities of the government, and (2) is not 
primarily in the commercial interest of the requester. I especially need to know how you intend to 
disseminate the information to the public. 

When submitting this additional information, please refer to the case number listed at the top left-hand 
corner of this letter, and send it to: 

FOI/Privacy Acts Division 

U.S. Department of Health and Human Services 

200 Independence Avenue S.W. 

Room 729H 
Washington, DC 20201 

If you are not satisfied with any aspect of the processing and handling of this request, you have the right 
to seek dispute resolution services from: 

Michael S. Marquis 

Director, FOI/Privacy Acts Division 

Assistant Secretary for Public Affairs (ASPA) 

Office of the Secretary (OS) 

U.S. Department of Health and Human Services (HHS) 

Room 729H 

200 Independence Avenue, SW 
Washington, DC 20201 

Telephone: (202) 260-7100 

Fax:(202)690-8320 

E-mail: MichaeI.Marquis@hhs. gov 


and/or: 


Office of Government Information Services 
National Archives and Records Administration 
8601 Adelphi Road - OGIS 
GoIIege Park, MD 20740-6001 

Telephone: 202-741-5770 
Toll-Free: 1-877-684-6448 
E-mail: ogis@nara.gov 
Eax: 202-741-5769 


Any questions regarding the status of this request should be directed to our office at 202-690-7453. 


Sincerely yours. 





Michael S. Marquis 
Director 

EOI/Privacy Acts Division 




